Realms of Cyber Conference 2025

28 Aug Brisbane, AUS
Inspiring and informative talks from some of the world's brightest minds in physical cybersecurity

About Realms of Cyber Conference

ROCC is a high-impact, one-day conference bringing together cutting-edge presentations, live technology demonstrations, and meaningful networking opportunities - all set in the inspiring surrounds of the iconic Brisbane Powerhouse.
Focused on operational security across physical domains - Land, Sea, Air, Space, Biological, and Cognitive - ROCC is dedicated to advancing Australia’s OT and cyber-physical resilience.
Attendees can explore multiple streams of expert talks, get hands-on with interactive tech displays, and connect in curated social spaces designed to spark real conversations and collaboration.

The Realms

Land
Sea
Air
Space
Biological
Cognitive

Speakers

We have an exciting list of speakers rolling out for our 2025 conference, check them out:
Kylie McDevitt
CEO & Founder
InfoSect
Read more →
Sasha Biskup
CISO
DroneShield
Read more →
Mike Monnik
CEO
DroneSec
Read more →
Ben Doyle
Former Thales CISO
Read more →
Michael Creagh
CEO
Skyborne Technologies
Read more →
David Robinson
Read more →
Ruarri Fairweather
Principal Advisor and Director
Heliswot Lawyers & Advisors
Read more →
Jocelinn Kang
Australian Strategic Policy Institute
Read more →
Dr Jessie Jacob
Australian Strategic Policy Institute
Read more →
James Carlopio
Co-founder and Director
Cultural Cyber Security
Read more →
Ben Sorensen
Roo-ver Mission & ELO2 Consortium Director
EPE
Read more →
Daniel Castillo
OT Cybersecurity Consultant
Enterprise IT & IACS Cybersecurity
Read more →
Gaurav Vikash
Head of Security and Risk (APAC)
Axon
Read more →
Bradley Butler
Principal Security Consultant
Mantel Group
Read more →
Jake Smith
OT Infrastructure Engineer | RPEQ | GICSP
EEHA Automation
Read more →
Kenneth Radke
Technical Director, Critical Infrastructure and Operational Technology Environments, Cyber Security Resilience
Australian Signals Directorate
Read more →
Alok Patel
Founder & CEO, Azcende & Azymmetric | Chairman, National Security Association of Australia
Azcende & Azymmetric
Read more →
Nicole Gibson
CEO
inTruth
Read more →
Travis Quinn
Security Consultant at AWS, PhD Candidate and Casual Academic at UNSW
AWS
Read more →
Judd McCann
Group Director
Ocebile
Read more →


MC

ROCC 2025 will be hosted by Adam Green and Gareth Smith:
Adam Green
Founder and CISO
Green Cyber Consulting
Read more →
Gareth Smith
Principal Advisor – Infrastructure and I&OT Security
President – ISA Queensland Chapter
Read more →
Get Tickets

Schedule

8:00 - 8:45

Registration

8:45 - 9:00

Theatre Open

9:00 - 9:20

Acknowledgement of Country and Opening Words

9:20 - 9:35

Cracking the Sonos: An Australian Team’s Journey to Pwn2Own 2024

Multi Realm
At Pwn2Own Ireland 2024, Kylie's team became the first fully Australian company to compete at any Pwn2Own event. They entered the Embedded Systems category with exploits for three targets and successfully demonstrated two. One of those was the Sonos Era 300 smart speaker, which earned them USD 30,000 and 3 Master of Pwn points after being the second team to exploit it. This talk covers their experience preparing for the competition—from dealing with last-minute firmware changes to the unlucky demo draw that shaped their outcome. Kylie will also introduce the exploit developed for the Sonos Era 300 and share insights into breaking a modern smart speaker. If you’re curious about embedded exploitation or what it’s like behind the scenes at Pwn2Own, this talk is for you.

9:35 - 10:50

Cyber Operations in Drone Warfare - Infiltrating the Stack

Air Realm
The face of warfare has changed, with small, cheap, attritable drones being used to target multi-million dollar assets globally. Covert cyber operations are taking place against drone supply chains, watering-hole attacks against firmware and cat-and-mouse innovation to evade countermeasures (C-UAS) in the battlefield. We will consider OPSEC and offensive techniques used by cartels, prison gangs and even military units within Ukraine, with intelligence that has come across our analyst’s desks.

9:50 - 10:05

Navigating the Cyber Storm: Incident Response on the High Seas

Sea Realm
Bradley's session dives into the critical realm of cyber incident response in the maritime domain. Drawing powerful parallels from a first-hand military crisis – a rocket attack in Afghanistan – we'll highlight the vital need for robust drills when a vessel faces a cyber threat. We'll then explore a theoretical ship cyber-attack scenario, drawing insights from our experience conducting tabletop exercises for various Operational Technology industries. We'll examine how to effectively assess, contain, communicate, and recover systems when hundreds of miles from shore. Finally, we'll cast an eye to the horizon, discussing the emerging response challenges of Maritime Autonomous Surface Ships (MASS) and their degrees of autonomy. Equip yourself to navigate the unseen digital storms of the sea.

10:05 – 10:20

The Roo-ver Mission: Cybersecurity and Space Capabilities

Space Realm
The Roo-ver Mission, led by ELO2 in partnership with the Australian Space Agency, will see Australia’s lunar rover traverse the Moon’s surface around the end of the decade. This briefing highlights cyber-critical aspects of rover design, including secure sensor technology, autonomous navigation, and communications integrity in extreme conditions. It explores threat mitigation strategies in high-risk environments and outlines protection mechanisms for command systems and mission data. Ben will offer insights into how this industry-research collaboration will develop and protect emerging space technologies. Mission challenges and constraints, including communications delays, weight restrictions, and the harsh lunar environment will also be addressed.

10:20 – 10:30

Group Q&A Session

10:30 – 11:25

Morning Tea Break

11:25 – 11:40

Full Stack Security for CUAS: Defending Against Modern Unmanned Threats

Air Realm
Sasha's presentation explores the critical need for a full stack security strategy in the context of Counter-Unmanned Aircraft Systems (CUAS) companies and manufacturers. We will examine the unique cyber and physical risks posed by autonomous and AI-driven platforms, the importance of mature security capabilities early in a company’s lifecycle, and the necessity of integrating security disciplines across hardware, software, and operational processes. Attendees will gain insights into threat modelling for product security, the interplay between hardware and software engineering, and the imperative of secure-by-design principles.

11:40 – 11:55

Real World Threats to Cognitive Security in Critical Infrastructure – Why We Need More Tools Than Ever Before

Cognitive Realm
As critical infrastructure becomes more interconnected and reliant on cyber-physical systems, a new frontline has emerged in the battle for security - the human mind. Adversaries are increasingly focusing on operators and decision-makers, exploiting trust, urgency, and authority to influence actions at key moments. These tactics, now supercharged by artificial intelligence, enable precision-crafted communications and scenarios that blend seamlessly into operational environments, making them harder to detect and easier to act upon.

From fabricated incident reports to convincing operational directives, these manipulative campaigns can mislead even experienced personnel, creating knock-on effects that disrupt physical systems as effectively as any technical breach. The convergence of accessible AI tools and evolving tradecraft has created an environment where the gap between offensive creativity and defensive readiness is widening.

Drawing on current threat intelligence and recent incidents, this session will explore how information operations are increasingly targeting the cognitive domain of critical infrastructure. We will examine why existing security frameworks - focused largely on systems and networks - are insufficient, and why protecting the decision-making process itself is now mission-critical.

Submarine cables: Submerged yet exposed

Sea Realm
A conversation between two subcable enthusiasts unpacks why undersea cables are seen as strategic assets in a shifting geopolitical landscape. It will explore why Australia is emerging as a digital hub, and what risks submarine cables, which carry 99% of all international internet traffic, face from sabotage, to cyber intrusions, to single points of failure. We’ll leave you with practical considerations to inform your risk management when selecting or securing digital services, emphasising the critical role of sovereign digital resilience for business continuity.

12:10 – 12:20

Group Q&A Session

12:20 – 12:25

Demo Announcement

Sea Realm
Introduction to "McBathy" bathymetric survey boat

12:25 – 13:40

Lunch Break: Live demonstration of Ocebile's "McBathy" bathymetric survey boat

13:40 – 13:55

Compromised by Design – The Hidden Risks of Wearable Technology

Biological Realm
Wearable devices promise convenience and health insights - but often at the cost of privacy, security, and user control. This talk explores how wearables collect sensitive biometric and behavioural data, the hidden risks of their connectivity and design flaws, and what organisations and individuals can do to mitigate exposure across health, defence, and workplace settings.

13:55 – 14:10

You Are Not Where You Think You Are: GNSS/GPS Threats at Sea

Sea Realm
Global Navigation Satellite Systems (GNSS) are integral to maritime navigation—guiding everything from cargo ships and cruise liners to fishing vessels and autonomous maritime systems. But what happens when GNSS is compromised? Attacks like jamming and spoofing are no longer theoretical—they’re happening in the wild, impacting maritime operations with growing frequency and sophistication. In this talk, we’ll explore how GNSS works, what global systems are in play, and how attackers manipulate positioning and timing signals. We’ll look at why ships aren’t always where they think they are—and how this disconnect can lead to near misses, accidental groundings, or even maritime incursions. We’ll break down real-world cases, including coastal jamming near North Korea and spoofing events in the Eastern Mediterranean.

14:10 – 14:25

Automating Secure-by-Design with – and for – Artificial Intelligence

Multi Realm
Secure-by-design is a software security engineering philosophy that seeks to integrate security from software design through development , deployment and operation. The proliferation of Artificial Intelligence (AI) and Machine Learning (ML) in enterprises adds complexity to secure-by-design as they are predominantly based in software and lend themselves to rapid design, development and deployment cycles, increasing the potential for vulnerabilities, anti-patterns and inefficiencies in performance and cost. However, AI/ML also brings exciting new capabilities to software development that when paired with a robust secure development methodology can accelerate secure-by-design, reduce security risk, and ensure developers are free to focus on high impact tasks. This presentation will address the challenges and opportunities that AI/ML represent for secure-by-design software development.

14:25 – 14:40

Supply Chains, Secure Comms, and Sovereign Risk

Land Realm
From depots to deployables, land-based operations face a unique blend of cyber and physical threats—made more complex by sprawling supply chains, field comms infrastructure, and increasing sovereign requirements. In this session, Ben Doyle draws on over two decades as a CISO overseeing security for defence-grade programs to explore what land operators must prioritise now. He’ll unpack real-world lessons on managing vendor accountability, mitigating risk across integrated systems, and building secure-by-design into procurement before the contract is signed. This is a call to action for leaders responsible for land-based assets to move beyond compliance and adopt resilient, future-facing strategies grounded in operational realities.

14:40 – 14:50

Group Q&A Session

14:50 – 15:45

Afternoon Break

15:45 – 16:00

War in the Heavens: Securing the New Space Race

Space Realm
Space is now a critical domain for cybersecurity. Satellites are essential to communications, navigation, and defense—and they're increasingly targeted. Australia regulates this through its Criminal Code, Radiocommunications, and Space Acts, while globally, the Outer Space Treaty and Liability Convention apply. However, there's no specific cyber treaty for space, creating legal gaps. Hacking a satellite may trigger international law, war-like consequences, or commercial liability. State actors, private companies, and individuals all face exposure. As the race to the Moon and commercial space accelerates, cybersecurity must be built into missions, not bolted on. Australia has an opportunity to lead, but policy must keep pace with orbital reality.

16:00 – 16:15

Cognitive Warfare in the Age of Deepfakes

Cognitive Realm
Dr James Carlopio will explore how nation-states now deploy AI‑generated deepfake videos as strategic tools of real‑time deception, manipulating perception and narrative through cultural and psychological levers. Drawing on examples from the Russia‑Ukraine conflict, and China–Taiwan tensions (including the March 2022 Zelensky deepfake and fake Taiwan election footage on TikTok) he’ll illustrate how deepfakes exploit cognitive biases, emotional triggers, trust dynamics and digital habits.

16:15 – 16:30

Decoding Emotion: Harnessing Biometric AI for Ethical Emotional Intelligence at Scale

Biological Realm
Emotions drive up to 80% of our decisions, yet remain one of the most under-explored aspects of human behaviour. Nicole Gibson, CEO and founder of inTruth Technologies, reveals how biometric wearables and AI can turn physiological signals into actionable emotional insights. She will share the science of quantifying emotion, the promise of emotional intelligence at scale, and the risks of storing such sensitive data online - if emotions are stored online, they can be targeted, manipulated, or exploited by bad actors, whether for commercial gain, political influence, or psychological harm. Nicole outlines how inTruth is building safeguards around cybersecurity, data sovereignty, and user control to protect the emotional core of human decision-making.

16:30 – 16:45

How to Arm Robots for Modern Warfare

Land/Air Realm
Arming robots has been a prominent topic since the invasion of Ukraine by Russia where First-Person View drones have dominated the battlefield. Skyborne Technologies has been arming robots for six years and has learnt many lessons along the way on topics of reliability, accuracy, autonomy and cyber security of such platforms. Michael Creagh discusses lessons learnt, current state of the art and the future of arming robots and keeping them in friendly hands. Michael will present on several different air and ground platforms, weapon systems (12 Ga, 40mm Grenade and warhead), and also discuss the economics of future attrition warfare.

16:45 – 16:55

Group Q&A Session

16:55 - 17:00

Closing Words

17:00 - 18:30

Networking Session and Closing Reception


OT Cybersecurity Stream

10:30 – 11:25

Morning Tea Break

11:25 – 11:30

MC Opening

11:30 – 12:00

Getting started in OT security, pitfalls and pathways

Multi Realm
What exactly is Operational Technology security, and why does it matter more now than ever? In this foundational talk, Gareth Smith breaks down the essential concepts behind OT environments security and highlights the unique risks these systems they face in today’s threat landscape. Tailored for those new to the field or bridging from IT security and OT engineering, this session offers a clear, jargon-free introduction to how physical systems are monitored, controlled, and protected. Whether you're a cyber professional crossing into industrial realms or an asset owner getting your head around digital this is your briefing room.

12:00 – 12:30

Protecting OT systems using engineering and cybersecurity

Multi Realm
Operational Technology (OT) systems remain the unseen backbone of modern infrastructure – yet securing them continues to trail behind traditional IT in maturity and resourcing. In this presentation, Dr Ken Radke explores the current state-of-the-art in OT security: what’s working, what’s not, and what’s simply misunderstood.
Blending engineering rigour with cyber defence expertise, Ken draws on real-world experience across national infrastructure to examine prevailing practices and their limitations. He challenges the audience to re-evaluate assumptions, proposing a set of theoretical and practical interventions – from protocol-level resilience and anomaly detection to embedding security into the engineering lifecycle itself.

12:30 – 13:40

Lunch Break (Catered)

13:40 – 14:10

Fighting the FUD: Pragmatic considerations for effective OT Vulnerability Management in Critical Infrastructure

Multi Realm
Fear, Uncertainty, and Doubt – otherwise known as FUD – has long hindered meaningful progress in Critical Infrastructure (CI) cyber resiliency programs. Release of the first annual report deadline for the Security of Critical Infrastructure (SOCI) Act prompted a nationwide rush by asset owners to implement a cyber risk management program based on several endorsed frameworks. In doing so, many quickly uncovered that OT vulnerability management was a critical gap in their capability.
Daniel's talk covers a pragmatic approach to the planning and execution of an effective OT vulnerability management program within CI environments. Attendees will walk away with actionable insights on what OT vulnerability management really entails, why it matters for both compliance and resilience, and how to measure its success within complex operational environments.
With guidance grounded in real-world experience, this session equips security leaders, engineers, and risk managers to reduce the OT attack surface, align with regulatory expectations, and move beyond the FUD that so often stands in the way of progress.

14:10 – 14:40

Insecure by design, the openness of Critical Infrastructure ICS

Multi Realm
Despite decades of progress in IT security, Industrial Control Systems (ICS) across critical infrastructure remain inherently vulnerable - not due to oversight, but by design. In this session, OT Infrastructure Engineer Jake Smith exposes the architectural assumptions and legacy protocols that leave ICS environments wide open to modern threats. Drawing on his experience in mining, underground operations, and field engineering, Jake unpacks why many systems were never meant to be secure and what engineers can practically do about it. From air-gapped myths to hardcoded trust, this presentation is a sobering look at the real-world limitations of ICS -and how to defend them anyway.

14:40 – 14:50

MC Closing

14:50 – 15:45

Afternoon Break

Tickets

Frontline Ticket

$330
Frontline ticket eligibility: Must work directly for a Frontline organisation, and register with organisation email to purchase this ticket.

General Admission

$990

Student Ticket

$165
Student ticket eligibility: Must be currently studying full time, and register with your student email to purchase this ticket.
-->

If you are experiencing financial hardship that is preventing you from purchasing a ticket, please Contact us.

Venue

How To Get Here

Brisbane Powerhouse is an iconic venue only 20 minutes from the Airport and 400 metres from Public Transport! It is a magnificent power station of the 1920s reborn as Queensland's home of contemporary art and culture located along the Brisbane River (Maiwar) on Yagara Country. We think it's a perfect location to be hosting Brisbane's pure cyberphysical conference.

Google Maps

Sponsors

ROCC is proudly supported by the following sponsors driving Australia’s cybersecurity future

Platinum

Queensland Government

Gold

Cultural Cyber Security
Pentester Labs
Thynne & Macartney
Sitle
Loc Cyber
SupplyDIO

Silver

Tarian Cyber
Siege Cyber
Silent Grid
Redwood Consulting
Hacker Content
Cube Cyber
Sekuro
Netskope

Bronze

Decipher Bureau
Flame Tree Cyber
Acumenis
DroneShield
Cydarm Technologies
SecAlerts
Green Cyber Consulting
Arctic Wolf
ACS
EEHA Automation

Exhibitors





Frequently Asked Questions

What is Frontline to ROCC?


  • Utilities: Water, Gas, Electricity, Energy
  • Education & Training: Schools, TAFEs, Universities
  • Infrastructure: Mining, Construction, Ports, Telecommunications, Space
  • Defence Industry
  • Trade, Retail, and Manufacturing
  • Healthcare & Medical
  • Transport: Aviation, Maritime, Rail, Road, Logistics
  • Public Administration: Government departments, LGAs
  • Financial Services: Banks, Superannuation, Insurance
  • Not-for-Profits & Charities

If your work helps things run, move, stay safe, or stay online — you belong at the intersection of cybersecurity, operational technology (OT), and cyber-physical systems (CPS).

Ticketing Questions


I’m a developer working in Qld Police. What ticket do I get?

You’re in public administration and Frontline.

I’m a recruiter. What ticket do I get?

You're welcome to purchase a general admission ticket.

I’m a student studying business. What ticket do I get?

You’re the future — grab the student ticket.

I work for a large supermarket chain in their logistics area. What ticket do I get?

You’re part of the national supply chain — that’s Frontline.

I work for a cybersecurity consultancy. What ticket do I get?

You’re in the commercial cyber sector — choose the general admission ticket.

I work for Catholic Education. What ticket do I get?

You’re in education and public service — that’s Frontline.

I deliver cybersecurity training. What ticket do I get?

If you’re with a public education or training provider (e.g. TAFE, university), grab a critical infrastructure ticket. If you’re private sector, choose general admission.

I work for a telecommunications company. What ticket do I get?

You’re part of national infrastructure — that’s firmly within critical infrastructure.

I work for a bank in their IT risk team. What ticket do I get?

Finance is critical infrastructure, especially in cyber.

I work in a local council’s facilities team. What ticket do I get?

Local government is public administration — you’re covered under critical infrastructure.

I’m a lawyer. What ticket do I get?

If you’re in-house counsel at a critical infrastructure organisation, you’re eligible for a critical infrastructure ticket. If you’re in private legal practice, please select a general admission ticket.

Still unsure which ticket to purchase? Contact us and we will get back to you ASAP.